How Long Should a Password Be?
A direct answer for every common situation, with the reasoning so you can judge cases this list doesn't cover.
Recommendations by Account Type
| Account type | Recommended length | Why |
|---|---|---|
| Low-risk / throwaway accounts | 12+ characters | Still resistant to realistic attack, minimal consequence if compromised |
| Everyday accounts (email, shopping, social) ⭐ | 16+ characters | Comfortable margin above any practical brute-force threshold |
| High-value accounts (primary email, banking, cloud storage) | 20+ characters | Extra margin for accounts that unlock access to many other things |
| Password manager master password | 5-6 word passphrase | Must be memorised — length in words, not characters |
| WiFi network password | 16-20 characters | Occasionally typed manually; WPA2/WPA3 max is 63 |
| API keys / service account credentials | 32+ characters | Machine-to-machine, no memorability constraint, maximise entropy |
Why 8 Characters Is No Longer Enough
Many systems still enforce an 8-character minimum — a holdover from when offline cracking was orders of magnitude slower. An 8-character password using all character types has about 52 bits of entropy, crackable in hours against modern GPU-based offline attacks. The same password with 16 characters reaches roughly 105 bits — a difference of billions of years in estimated crack time, not a linear improvement.
Does Length Ever Stop Mattering?
Practically, yes. Once entropy comfortably exceeds anything a realistic attack could exhaust — roughly 100+ bits, which a 16-character full-charset password already reaches — additional length is free margin rather than a meaningful practical improvement. Going from 20 to 32 characters doesn't make a functional difference against any attack that would already fail at 20; it mainly matters for accounts you specifically want an extra-large safety buffer on, or where the character pool is restricted (like numeric-only passwords, which need much greater length to compensate — see our Numeric Password Generator guidance).
What Matters More Than Extra Length
Beyond a reasonable minimum (16 characters), these factors matter more than adding further length:
- Uniqueness — a 20-character password reused across accounts is only as strong as the weakest site storing it.
- True randomness — a human-chosen 20-character "password" is typically far less secure than its length suggests.
- Storage — the strongest password is only as safe as where you keep it (a password manager, not a sticky note).
Frequently Asked Questions
12 characters is a reasonable practical floor for a full-character-set password. NIST's official minimum is 8, but that's a floor, not a target — use 16+ whenever the account allows it.
Practically, yes — once entropy exceeds roughly 100 bits (around 16 characters with a full pool), further length is free security margin rather than a functional necessity against realistic attacks.
16-20 characters is a good target — WPA2/WPA3 supports up to 63, but that length balances strong security with the practical need to occasionally type it on a new device.